Unable to create multiple VMUsers with JWT configuration in same namespace

Problem

When I try to create multiple VMUsers in the same namespace matching on different claims, only one of them is created successfully. The second CR fails to sync with vm-operator and reports an error.

The first user is correctly rendered as a jwt: entry, while the second is dropped with a basicAuth:***** duplicate-id error.

Environment

• Operator controller image: victoriametrics/operator:v0.74.0
• Operator Helm chart: victoria-metrics-operator 0.67.2
• vmauth: v1.148.0
• Kubernetes: 1.34.1

Manifests to reproduce the issue

apiVersion: operator.victoriametrics.com/v1beta1
kind: VMUser
metadata:
  name: awesome-team-logs-user
  namespace: harbor
  labels:
    vmauth: users-logs
spec:
  name: awesome-team-logs-user
  jwt:
    oidc:
      issuer: https://dex.example.com
    matchClaims:
      ### Matching users with claim `groups` by specific value
      groups: "awesome-team@example.com"
    defaultVMAccessClaim: {}
  targetRefs:
    - static:
        url: "http://vlselect-prod.victoria-metrics.svc.cluster.local.:9471"
      paths:
        - "/select/.*"
      query_args:
        - name: extra_stream_filters
          values:
            - '{"kubernetes.pod_namespace":"harbor"}'

---
apiVersion: operator.victoriametrics.com/v1beta1
kind: VMUser
metadata:
  name: custom-access-user
  namespace: harbor
  labels:
    vmauth: users-logs
spec:
  name: custom-access-user
  jwt:
    oidc:
      issuer: https://dex.example.com
    matchClaims:
      ### Matching custom user by `email` claim. User is not in `groups: "awesome-team@example.com"`
      email: "custom-user@example.com"
    defaultVMAccessClaim: {}
  targetRefs:
    - static:
        url: "http://vlselect-prod.victoria-metrics.svc.cluster.local.:9471"
      paths:
        - "/select/.*"
      query_args:
        - name: extra_stream_filters
          values:
            - '{"kubernetes.pod_namespace":"harbor"}'

After running kubectl apply, the resources get the following statuses:

apiVersion: operator.victoriametrics.com/v1beta1
kind: VMUser
metadata:
  creationTimestamp: "2026-08-21T11:50:40Z"
  finalizers:
    - apps.victoriametrics.com/finalizer
  generation: 1
  labels:
    vmauth: users-logs
  name: awesome-team-logs-user
  namespace: harbor
  resourceVersion: "765177668"
  uid: ce582754-5b7a-46d8-ae2c-3395fd3c7464
spec:
  jwt:
    defaultVMAccessClaim: {}
    matchClaims:
      groups: awesome-team@example.com
    oidc:
      issuer: https://dex.example.com
  name: awesome-team-logs-user
  targetRefs:
    - paths:
        - /select/.*
      query_args:
        - name: extra_stream_filters
          values:
            - '{"kubernetes.pod_namespace":"harbor"}'
      static:
        url: http://vlselect-prod.victoria-metrics.svc.cluster.local.:9471
status:
  conditions:
    - lastTransitionTime: "2026-08-21T11:50:40Z"
      lastUpdateTime: "2026-08-21T11:50:40Z"
      observedGeneration: 1
      reason: ConfigParsedAndApplied
      status: "True"
      type: mgmt-victoria-metrics-k8s-stack.metrics.vmauth.victoriametrics.com/Applied
  observedGeneration: 1
  updateStatus: operational
---
apiVersion: operator.victoriametrics.com/v1beta1
kind: VMUser
metadata:
  creationTimestamp: "2026-08-21T11:50:40Z"
  finalizers:
    - apps.victoriametrics.com/finalizer
  generation: 1
  labels:
    vmauth: users-logs
  name: custom-access-user
  namespace: harbor
  resourceVersion: "765177685"
  uid: 10d9ba00-cc69-4760-ad8a-b927d684f68e
spec:
  jwt:
    defaultVMAccessClaim: {}
    matchClaims:
      email: custom-user@example.com
    oidc:
      issuer: https://dex.example.com
  name: custom-access-user
  targetRefs:
    - paths:
        - /select/.*
      query_args:
        - name: extra_stream_filters
          values:
            - '{"kubernetes.pod_namespace":"harbor"}'
      static:
        url: http://vlselect-prod.victoria-metrics.svc.cluster.local.:9471
status:
  conditions:
    - lastTransitionTime: "2026-08-21T11:50:40Z"
      lastUpdateTime: "2026-08-21T11:50:40Z"
      message: vmuser=harbor/basicAuth:***** has duplicate id with vmuser=harbor/basicAuth:*****
      observedGeneration: 1
      reason: ConfigParsedAndApplied
      status: "False"
      type: mgmt-victoria-metrics-k8s-stack.metrics.vmauth.victoriametrics.com/Applied
  observedGeneration: 1
  reason: vmuser=harbor/basicAuth:***** has duplicate id with vmuser=harbor/basicAuth:*****
  updateStatus: failed

The final config inside the VMAuth Pod looks like this:

/ # cat /opt/vmauth/config.yaml
# tls-assets-hash: ef46db3751d8e999
users:
- url_map:
  - url_prefix:
    - http://vlselect-prod.victoria-metrics.svc.cluster.local.:9471?extra_stream_filters=%7B%22kubernetes.pod_namespace%22%3A%22harbor%22%7D
    src_paths:
    - /select/.*
  name: awesome-team-logs-user
  jwt:
    match_claims:
      groups: awesome-team@example.com
    oidc:
      issuer: https://dex.example.com
    default_vm_access_claim: {}

Expected behavior

When multiple JWT VMUsers are created in the same namespace, they should all be appended to the VMAuth config.